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ABSTRACT 



A method and apparatus are provided for monitoring a 
cellular mobile radio system and for identifying monitored 
rad io elements within the network with respect to other 
network entities. The logical and p hysical topology of a 
cellular mob ile radio system is deter wiiied by monitoring 
messages passed across a communications interface in the 
system. Embodiments of the invention associate common 
information occurring in different messages, and over time, 
establish the topology of a network, even though messages 
passed across the monitored interface do not comp rise 
unique system-wide addressing information. In particular, 
the present method provides a mapping between radio 
elements (TRX) and other network entities (TEI, CI, and 
LAI) in a GSM type cellular system by m onitoring ca esaages 
xrvfYVi thp. Ahfc And A inkrfaT'i , 

18 Claims, 14 Drawing Sheets 
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NETWORK DISCOVERY METHOD AND is installed A technique for determining the functionality of 

APPARATUS FOR CELLULAR MOBILE nodes of a network is disclosed in European patent appli- 

RADIO NETWORKS cation 0 738 091. This technique relies on the monitoring of 

signalling messages which include addressing information 

The present invention relates to a network discovery 5 associating the messages with specific nodes, as is for 

method and apparatus for a cellular mobile radio network, example the case for SS7 (Signalling System No. 7) links, 

and in particular to a network discovery method and appa- According to the present invention, there is provided a 

ratus for identifying radio elements within such a network. network discovery method for determining information 

The present invention has particular application to eel- about a cellular mobile radio network comprising a fixed 

hilar mobile radio systems operating according to theGSM, 10 part having switching elements and radio elements provid- 

DCS1800, or the PCS 1900 stand ards_ 1 _ J*ystejri s opera ting ing radio coverage in a plurality of cells, each cell having at 

according to these standards, including derivatives thereof, least one said radio element, and mobile stations for com- 

will hereinafter be referred to as " GSM-typ e" systems. It municating with said fixed part via the radio elements, the 

should, however, be noted that the present invention is not method comprising: monitoring signalling messages passed 

restricted to a GS frl-type sys tem. is between the radio elements and the switching elements, 

Cellular mobile radio Systems, such as GSM -type selecting at least one signalling message in accordance to 

systems, comprise a fixed part having switching elements predetermined selection criteria, extracting data from said at 

and radio elements providing radio coverage in a plurality of least one message, correlating said extracted data with 

cells, and mobile stations for communicating with the fixed previously extracted data and, repeating said selecting, 

part of the system. Cells are often logically grouped into 20 extracting and correlating steps until each monitored radio 

location areas. Within each cell, radio coverage is provided element is identified with respect to other network entities, 

by one or more radio elements, which, in the case of The present applicant has appreciated that in order to 

GSM-type systems, comprise elementary transceivers identify radio elements, the correlation of data extracted 

termed TRXs (Transmitter Receiver). Radio elements are from a plurality of signalling messages passed between radio 

grouped within Base Transceiver StaUons^XSIS). which 25 elements and switching elements is required. For GSM-type 

communicate with Base Station Controllers £B§£)- The networks, this requirement stems from the absence of unique 

interface between a BTS and BSC, within a GSM-type network wide addressing information on the Abis interface 

system, is referred to as the Abis interface, and individual between radio elements or TRXs, and the BSC. Whereas the 

links (generally comprising two physical channels) on this SS7 protocols utilised on the A interface provide for the 

interface are termed Abis links. BSCs communicate with 30 unique identification of A interface links, no such provision 

mobile switching centres /MSP) via --what is termed the A is made for Abis links. On the A interface, links have an 

interface. identification which is given by the Originating Point Code, 

In order to monitor, and optimise, the performance of a the Destination Point Code and the Signalling Link Code, 
cellular mobile radio system it is often necessary to deter- Abis interface links have no such identification provided by 
mine the topology of the network. Although this information 35 protocol. Abis interface links are identified implicitly by 
may be derived from switching elements, such as BSCs and configuration information stored within the BSC, and TRXs 
their related databases, within the fixed part of the network, are addressed by using an identifier (a TEI — Terminal End- 
there are problems in doing so. Firstly, although many point Identifier) which is allocated by the BSC. Embodi- 
aspects of GSM-type networks have been standardized, ments of the present invention provide a technique for 
there are some areas in which equipment manufacturers 40 building up information on radio elements until their topo- 
have a number of technological choices which will meet the logical relationship to other network entities can be identi- 
relevant standards, and other areas in which standardization fled. Such information once determined can be used for 
has not been enforced. An area which is not highly stan- many purposes. For example it can be used to compare the 
dardized is that of Operation and Maintenance (O & M) level of network resources available to the current level of 
messages. Thus in order to access O & M messages a 45 usage of these resources. 

specific, proprietary format which is unique to an equipment Although data may be extracted from a single message 

manufacturer may be required. Secondly, due to the highly may usefully be used in the present network discovery 

sensitive nature of some information stored within the fixed technique, preferably a pair of signalling messages are 

part of a network, a network operator severely restricts selected in accordance with predetermined selection criteria, 

access to databases associated with network switching ele- so Often, cells within a mobile radio network are logically 

ments such as BSCs and MSCs. Finally, there is no guar- grouped into location areas, and in this case a radio element 

antee that the information stored within databases associated is preferably identified by the cell within which it resides, 

with switching elements is up to date, since changes made and the location area within which the cell resides. In 

to the system may not have been incorporated into these embodiments of the present invention, this hierarchical 

databases. 55 identification by network entity provides a logical identifier 

It is known to carry out independent monitoring of the for each radio element. A physical identifier, provided by the 

signalling network of a cellular mobile radio network, for monitoring system may be correlated with this logical 

example by temporarily or permanently installing monitor identifier. 

probes on one or more links to monitor messages flowing on Preferably the predetermined selection criteria for select- 

the link or links. A number of techniques are known for 60 ing a pair of messages are, firstly that each message is of a 

monitoring signalling messages in order to determine vari- different message type, and secondly that the messages 

ous parameters of a cellular mobile radio system. For contain at least one information element in common, 

example, European patent application 0 710 043 discloses a Advantageously, there is provided a further matching step in 

technique for determining the location area information for which the common information element in each of the 

cells within a GSM-type network, and European application 65 messages is compared and data from the pair of messages is 

0 658 032 (U.S. Pat. No. 5,521,902) discloses a technique only utilised in said correlating step if the common infor- 

for identifying the A interface link on which a monitor probe mation element in each message is identical. 
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Preferably data from a pair of messages is only utilised FIG. 12 is a flowchart of the steps taken and the messages 

in identifying radio elements if the messages are monitored utilised during the TRX aggregation procedures of embodi- 

within a predetermined time period of each other. It is ments of the present invention, 

difficult to identify messages on the Ab is interface which FIG. 13 is a schematic diagram showing the sequence of 

relate to the same transaction, because signalling messages 5 messages sent as a consequence of an "initial message" sent 

on the Abis interface do not carry unique identification by a j^s^ 

information. By utilising only messages which are mom- FIG { 4 is a schematic diagram showing the sequence of 

tored within a predetermined period of each other, the messages which are generated during inter BSC handovers, 

likelihood that these messages belong to the same transac- FIG. 15 is a flowchart of the steps taken and the messages 

tion is increased. Preferably the time period is one which is w utfliged duri ^ Q delenninalion procedures of embodi . 

monitored' mCSSa8CS meDtS of the P resenl invemion > 

Preferably, in addition to monitoring signalling messages *\ G ' 16 » a schematic showing the messages 

between radio elements and switching elements, messages senl dunn S * e P^S P^dmc used to notify a MS of an 

passed between two switching elements are also monitored. incoming call, and 

Thus, in GSM-type networks signalling messages on the A 15 FIG - 17 1S a flowchart of the steps taken and the messages 

interface, in addition to the Abis interface, are monitored. utilised durin S lhe ^ determination procedures of embodi- 

According to a second aspect of the present invention, ments of the present invention, 

there is provided apparatus for identifying the relationship Embodiments of the present invention will be described 

between radio elements and other network entities within a with reference to a cellular mobile radio network operating 

cellular mobile radio network, the network comprising a 20 in accordance with the GSM technical specifications. The 

fixed part having switching elements and radio elements GSM technical specifications as published by the European 

providing radio coverage in a plurality of cells, each cell Telecommunications Standards Institute (ETSI secretariat, 

having at least one said radio element, and mobile stations F-06921 Sophia Antipolis CEDEX, France, e-mail: 

for communicating with said fixed part via the radio secretariat@etsi.fr) are hereby incorporated herein by refer- 

elements, the apparatus comprising: probe means for moni- 25 ence. 

toring signalling messages passed between an identified one With reference to FIG. 1, a GSM network comprises a 

of the radio elements and the switching elements, extracting Network and Switching Subsystem (NSS) 1, which connects 

means for extracting data from predetermined signalling with a plurality of Base Station Subsystems (BSS) 2. The 

messages, analysis means for determining from extracted BSS provide radio communication with mobile stations 3 

data a relationship between the monitored radio element and 30 (only one of which is shown in FIG. 1). The NSS 1 also 

other network entities. communicates with the fixed public network 4 (i.e. with the 

Embodiments of the present invention will now be Public Switched Telephone Network — PSTN, and the Inte- 
described, by way of example only, and with reference to the grated Services Digital Network — ISDN). The NSS 1 corn- 
following drawings in which: prises a number of Mobile Switching Centres (MSG) 5, 

FIG. 1 is a schematic diagram of a GSM-type mobile 35 Home Location Registers (HLR) 6, and Visitor Location 

communications network, Registers (VLR) 6. MSCs perform the function of switches, 

FIG. 2 is a schematic diagram of a three sector BTS in a similar manner to PSTN switches, but also deal with the 

showing the TRXs serving each cell, additional functionality required for mobile networks e.g. 

FIG. 3 is diagram showing the relationships between registration, authentication location updating, international 

various protocols used in GSM networks, 40 roaming, connection to the PSTN. HLRs contain informa- 

FIG. 4 is a schematic diagram of a monitoring system tion on subscribers to the mobile network e.g. location, 

according to embodiments of the present invention showing mobile identity, while VLRs contain a subset of the HLR 

its connections to a mobile network, information which is required when a mobile station is in a 

FIG. 5 is a flowchart of the message matching procedure particular geographical location, 

utilised in embodiments of the present invention, 45 Each BSS 2 comprises a Base Station Controller (BSC) 

FIG. 6 is a schematic diagram showing the sequence of 8 and a plurality of Base Transceiver Stations (BTS) 9. 

messages generated during the request for a channel by an Referring now to FIG. 2 each BTS 9 comprises one or more 

MS, and the subsequent allocation of a channel by a BSC in elementary transceivers (TRX) 10 and at least one Base 

a GSM mobile network, Controller Function (BCF) 11. Each TRX 10 can emit and 

FIG. 7 is a flowchart of the steps taken and the messages 50 receive radio signals and provides radio coverage over a 

utilised during the TRX discovery procedures of embodi- local area known as a cell. The number of TRXs per cell and 

ments of the present invention, the number of cells per BTS is dependent on the traffic 

FIG. 8 is a schematic diagram showing the channel capacity that the network operator wishes to cater for. 

allocation strategies available to operators of GSM mobile The radio interface between a mobile station 3 and BTS 

networks, 55 9 is standardized within a GSM network. Similarly, the 

FIG. 9 is a schematic diagram showing messages, sent to interface between each BTS 9 and its associated BSC 8, by 

a pair of TRXs, which can be used to aggregate the TRXs which user data and signalling are exchanged, is also 

according to embodiments of the present invention when standardized, and is known as the Abis interface. Each BSS 

ciphering has been implemented by a network operator, 2 communicates with an MSC 5 over a standardized inter- 

FIG. 10 is a schematic diagram showing messages, sent 60 face known as the A interface, 
to a pair of TRXs, which can be used to aggregate the TRXs In GSM networks, user data and signalling are multi- 
according to embodiments of the present invention whether plexed across the radio interface, the Abis interface and the 
or not ciphering has been implemented by a network A interface. Signalling within the NSS 1, over the A inter- 
operator, faces to the BSCs 8 and with the PSTN 4, is effected through 

FIG. 11 is a schematic diagram showing a "directed 65 signalling links which utilise signalling schemes based on 

retry", in which a traffic channel from a TRX which is not the SS7 standard. FIG. 3 illustrates some of the protocols 

within the MS's current cell is allocated to the MS, utilised in GSM. A number of the protocols have multiple 
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layers, and in many cases messages are transparent to some 
of the nodes through which they pass, for example some 
messages from the MS to the MSC will pass transparently 
through the BTS and BSC. Protocol layers which transpar- 
ently pass messages through a node are shown as a dashed 5 
line in FIG. 3. 

Radio Resources Management 

This projoajL iayer is used^for paging, radio channel 
a ccess, ciphe ri ng, handove r, radio signal con trol proced ures, 
and radjo si g nal m eas urements. RR messages pass between 10 
t he MS and jhe BSC, and are transparent to t he BTS. 
R adio S iitoste ffl-^ 4anag cmcri t-fRSM ) 

RSM, although a term of this art, is not an official GSM 
name, and is often referred to by the GSM technical speci- 
fication which describes these messages i.e. GSM08.58. 15 
RSM messages relate to the management of radio resources 
by the BTS. These messages appear only on the Abis 
interface and are carried by the LAP D protocol. 
Call Management (CM) 

Thf^^MnnagWnfnT^TT^ft^ls comprises Call Control 20 
(CC), Short Message Service (SMS) and Supplementary 
Services (SS). CM messages pass transparently from the MS 
through the BTS and BSC to the MSC. 
Mobility Management (MM) 

As for CM m essa ges, MM messages pass between the MS 25 
and MSC, and are transparent to the BTS and BSC 
BSS Management Application Part (BSSMAP) 

BSSMAP messages pass between the BSC and MSC and 
are used to manage resources at the BSC. These messages 
are passed across the A interface via MTP (Message Transfer 30 
Part) and SCCP (Signalling Connection Control Part) pro- 
tocols which are both based on the SS7 standard. 

Layer 1, the signalling layer of the Abjs interface, is 
digital, usually at a data rate of 2048 kbit/ sec with a frame 
st ructure' of 32x64 kbit/sec time slots [I TU-T G.703]. It is 35 
these time . slots that are monitored in accordance with 
embodiments of the present invention. 

Layer 2 of the Abis interface is based on a standard ISDN 
protocol called LAPD (Link Access Procedure on the 
D-channel). This is defined by CCITT recommendation 40 
Q.920 and Q.921 and in Europe by ETS 300125 produced by 
ETSI. LAPD provides for the identification of the terminal 
end points of a data link by the use of TEIs in the address 
field of each frame. GSM has adopted the use of TEIs for the 
addressing of TRXs by BTS's. 45 

Layer 3 is the layer in which messages are carried, in the 
Abis interface within the RSM protocols, and on the A 
interface within the BSSMAP and SCCP protocols. 

An overview of a discovery method according to the 
present invention will now be given, prior to describing this 50 
method in greater detail. With reference to FIG, 4, moni- 
toring equipment 12 is utilised to monitor links on both the 
Abis interface and the A interface of a GSM network. The 
monitoring equipment 12 comprises probes 13 attached to 
test points on both the Abis and A interfaces at a BSC site, 55 
an HP E4251A Cardcage 14 available from Hewlett-Packard 
Limited, and an analyser 15, comprising a Hewlett-Packard 
HP9000 series 800 Unix server, for analysing and correlat- 
ing the monitored data. A communications link 16 is pro- 
vided from the analyser 15 so that the results of the auto- 60 
discovery of radio elements may be accessed from a remote 
location. Each probe 13 monitors a particular time slot on a 
communications bearer on either the Abis or A interface, and 
is connected to a particular interface card within the Card- 
cage 14. 65 

The monitoring system 14 is configured to attach a header 
to each data message monitored by a probe 13. This header 
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comprises a time stamp which records the time at which the 
monitoring system received the message, event information 
and a physical identifier, which uniquely identifies the 
monitored time slot. The event information indicates 
whether the message has been monitored from, for example, 
an Abis or an A interface and is recorded for each timeslot 
by the analyser 15 at the time the probes 13 and monitor 
system 14 are initially connected to the network. This 
information may be supplied by the network operator and 
input to the analyser, or may be deduced by the analyser 
from messages monitored on each timeslot. The physical 
identifier attached to the message by the monitoring system 
may comprise for example the cardcage number of the 
monitoring system, the interface card number of the 
cardcage, the bearer number of the communications link 
being monitored and the time slot number being monitored. 

Although the physical identifier attached to the message 
by the monitoring system allows the time slot on which a 
message has been monitored to be uniquely identified, a 
further level of physical identification is required in order to 
be able to uniquely identify the source or destination of the 
data message i.e. a TRX. This further level of physical 
identification is required because within GSM systems it is 
possible for more than one TRX to send data messages on 
the same time slot. The final level of physical identification 
is provided by the TEI which is sent within the layer 2 
LAPD. Each time a message is monitored by the monitoring 
system 14, the analyser 15 extracts the TEI from layer 2 and 
combines it with information from the header attached by 
the monitoring system in order to construct a physical 
identifier as follows: 

Physical Identifier: cardcage number; interface card number; 
bearer number; time slot number; TEI 

A person skilled in this field will appreciate that alterna- 
tive monitoring systems may utilise alternative physical 
identifiers. However, if the network being monitored utilises 
one timeslot for more than one TRX, the TEI should be used 
as part of the physical identifier. 

An aim of network discovery methods according to 
embodiments of the present invention is to map each physi- 
cal identifier allocated by the monitoring system to a moni- 
tored TRX to a logical identifier which uniquely identifies 
the TRX within the logical structure of the monitored 
cellular mobile radio network. In GSM networks a conve- 
nient logical identifier comprises a hierarchical combination 
of the Location Area Identity (LAI), the Cell Identity (CI) 
and the TEI for a TRX. The TEI is thus used both as a part 
of the physical identifier identifying a physical channel and 
as part of the logical identification of the radio elements 
within the topology of the mobile network. The hierarchical 
logical identifier for each TRX is deduced by the analyser 15 
by correlating data extracted from monitored messages. 
There are four basic processes carried out by the analyser 15 
as follows: 

Process 1 Discovery of TRXs 

Process 2 Aggregation of TRXs belonging to the same cell 
Process 3 Determination of cell identifier 
Process 4 Determination of location area identifier 

There is no required temporal order in carrying out these 
processes, and the order in which they are successfully 
achieved depends on the type of messages which happen to 
be monitored by the monitoring system 12 and the order in 
which these messages are monitored. Several of these pro- 
cesses may be carried out in a single step if the appropriate 
message is monitored. 

A key aspect of the discovery method is the correlation, 
or matching, of pairs of signalling messages, to determine 
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which messages contain common information elements. window lengths are too long this will lead to messages being 

When two messages contain common information elements falsely correlated, while if time windows are too short this 

it can be deduced that they relate, for example to the same will lead to an excessive number of messages being dis- 

TRX, cell, or LAI. However, because many of the signalling carded and the network discovery method will take an 

messages, particularly on the Abis interface, do not carry 5 excessively long time to discover the network. The messages 

data which uniquely identifies their source or origin, a pair monitored to carry out the four processes of the discovery 

of messages containing common information elements may method should in general be chosen to be ones which carry 

not necessarily be logically related. In order to overcome as much network data as possible, but also ones which 

this difficulty embodiments of the present discovery method appear on the network as often as possible, so as to ensure 

employ a time window when matching messages. to rapid discovery of the network. 

This message matching technique will now be described Process 1 — Discovery of TRXs 

with reference to j gG. 5. The first message of type A, of a Each TRX is served by two physical channels, one along 

pair of messages received by the monitoring system 12 is which messages are received, and one along which messages 

time stamped and stored. When a second message of type B are sent from the TRX. These two channels define a logical 

is received by the monitoring system 12 its time of arrival is 15 link, and the present process determines the relationship 

compared with the time stamp of message A, or if at the time between TRXs and links. This is achieved by monitoring 

of arrival of the B type message, several A type messages are pairs of messages, until one pair of messages are determined 

stored, the B type message arrival time is compared with the by the analyser 15 to be passing to and from the same TRX, 

timestamps of all A type messages. If the difference in time and therefore to be on the same link. Once such a pair of 

between the arrival of a B type message and the timestamp 20 messages have been identified, the analyser 15 records that 

of a particular A type message is less than a predetermined the particular TRX (identified by its TEI) is served by a 

time window further processing of the two messages occurs. particular link comprising two channels identified by the 

If the time difference between the B type message and a physical identifiers attached to the messages by the moni- 

p articular A type message is greater than this time window, toring system 14. Three procedures, each involving the 

this particular A type message is discarded. If the time 25 monitoring of different pairs of messages, can be used to 

difference between the B type message and all stored A type carry out the present process. Two pairs of messages are 

messages is greater than the pre-determined time window, generated during the request for a channel by an MS, and the 

the B type message is discarded. subsequent allocation of a channel by a BSC. The messages 

If a B type message is within the time window from the passed, are shown schematically in F IG. 6. T he MS com- 

arrival of an A type message, the data contained within the 30 mences the sequence of messages by sending a re quest ^ 

B type message is compared to that within the A type message icTTKe network for a traffic channe l. Thisinitial 

message to determine if there are any common information mes sage generates pairs of messa g es between the BTS and 

elements. If such common information elements are found, the B SC on the Abis interface, and it is these pairs, of 

further actions are taken by the analyser 15 which are me ssages t hal-aiejscdidiLjaU ^ monitoring system, 

dependent on the nature of A and B messages, and which 35 The third pair of messages that can be utili sed in th is process 

will be described in detail below. is generated du riog^ hT"channet release procedu re: ' 

If common information elements are not found message B Accgss regyeKLpmcejluie 

is discarded, but message A is retained for matching with The first pair of messages that can be utilised are sent 

further, later messages of type B arriving within the time during the access request procedure and belong JoJce^R SM 

window. 40 protocol. ( "The first (type A) message is the CHANnel 

An additional, optional, further check on the validity of Re^ufreD message [GSM TS 08.58, 8.5.3] and the second 

message matching can be carried out. Rather than accepting (type B) message is the IMMediate Assignment CoMmanD 

a message match as being successful when common infor- message [GSM TS 08.58, 8.5.6]. CHAN RQD is sent from 

mation is matched between a message B and one message A, the TRX to the BSC, while IMM ASS CMD is sent from the 

further comparisons with stored messages of type A may be 45 BSC to the TRX. The IMM ASS CMD message carries one 

carried out. If the common information element within of three possible RR assignment commands: IMMEDIATE 

message B is found within more than one message of type ASSIGNMENT [GSM TS 04.08, 9,1.18], IMMEDIATE 

A, within the time window, then these messages are dis- ASSIGNMENT EXTENDED [GSM TS 04.08, 9.1.19], and 

carded. If, after matching with all messages of type A, the IMMEDIATE ASSIGNMENT REJECT [GSM TS 04.08, 

common information element within the B message has 50 9.1.20]. The common information element, searched for by 

been found within only one A message, the message match- the analyser 15, between the CHAN RQD message and any 

ing is deemed to be successful. Thus, by discarding non one of the three IMM ASS CMD messages is a request 

unique message matches, greater confidence can be placed reference element [GSM TS 08.58, 9.3.19]. This request pn^* 

in the message matching process. Whether this alternative, reference comprises a random access part fGSM TS 04.08, & £L 

more secure, message matching procedure is utilised 55 9.1.8] (a s mall random number of betwee n 2 and 5 bits) t» \»v£^ 

depends on the relative importance placed by the operator of which identifie s the access request f and an* absolute fr ame vAft*^^ 

the discovery method on speed of discovery, level of pro- nugto [GSM TS 04.08, 10.5.2.38] (a modulo 42432 num- 

cessing available, and the level of confidence required in the ber related to the absolute time of the frame). Although the 

results of the discovery method, absolute frame number is a large number, there is still a 

The length of the time window may be different for 60 danger that two unrelated messages will be monitored 

different message pairs, and should be chosen to be a small containing the same abso lute frame num ber, for example if 

multiple of the typical time interval between messages of two requests were made from different TRXs at the identical 

that type on the network being monitored. In order to choose absolute time. Hence when matching messages the analyser 

appropriate time window lengths, messages on the network 15* employs the whole of the request reference element, 

should be monitored for some time, and the typical intervals 65 including both the random access part and the absolute 

between particular messages determined. Time window frame number in order to avoid false matches. Once the 

lengths can then be optimised by trial and error. If time monitoring system receives a CHAN RQD message and any 
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one of the IMM ASS CMD messages within a predeter- 
mined time window of each other, and these messages 
contain identical request reference elements, then the analy- 
ser 15 will record that the two physical identifiers attached 
to these two messages belong to the same TRX and thus that 
the two monitored physical channels belong to the same 
logical link. 45 milliseconds has been found to be a suitable 
time window for this message pain 

A disadvantage in utilising the access request procedure to 
identify TRX links is that these # a ccess reques l-jBessages 
only appear on TRXs which have a CCCH (Common 
Control CHannel). CHAN RQD is sent to a TRX on the 
R andom Access Channel (RAC H) and the TRX will respond 
with a IMM ASS CMD message on the downlink CCCH. 
The access request procedure can thus only be used to 
discove r links that belong to TRXs which employ common 
co ntrol ch a nnels, a nd cannot be used to discover links t hat 
belong to TRXs whtch employ only tratnc cnanneis. 
CKannel activation procedure 

The second procedure utilises one type A message and 
one of two possible messages ot type B. These messages, all 
belonging to the RSM protocol, are respectively the CHAN- 
nel ACTIVation message [GSM TS 08.58, 8.4.1], the 
CHANnel ACTIvation ACKnowledge message [GSM TS 
08.58, 8.4.2], and the CHANnel ACTIvation Negative 
ACKnowledge message [GSM TS 08.58, 8.4.3]. CHAN 
ACTIV is sent from the BSC to the TRX, the other two are 
sent in the opposite direction. The CHAN ACTIV NACK 
message is sent only if the TRX fails to allocate the required 
channel otherwise the CHAN ACTIV ACK message is sent. 
The common information element that is sought between the 
CHAN ACTIV message and one of the CHAN ACTIV ACK 
or the CHAN ACTIV NACK messages is the channel 
number [GSM TS 08.58, 9.3.1]. This number is an octet 
which identifies the channel to be allocated i.e. the channel 
type, time slot, and potentially sub time slot. Again, once the 
monitoring system has identified identical channel numbers 
within two of these messages received within a pre-defined 
time window of each other, the physical identifiers attached 
to the messages can be associated with a particular TRX. 

The use of this procedure has the advantage that all TRXs 
send and receive these messages, and thus the links for all 
TRXs can be discovered by monitoring these messages. A 
disadvantage in using the channel activation procedure is 
that the channel number can only assume 120 different 
values, thus the same value is relatively frequently utilised 
within channel activation messages which relate to different 
TRXs. It is thus particularly important to correctly deter- 
mine a time window value to be used in the message 
matching procedure so as to avoid incorrect association 
between TRXs and physical channels. 20 milliseconds has 
been found to be a suitable time window for this message 
pair. 

Channel release procedure 

Two messages are utilised in the channel release proce- 
dure for TRX link discovery. These are RF CHANnel 
RELease [GSM TS 08.58, 8.4.14] sent from the BSC to the 
TRX and RF CHANnel RELease ACKnowledge [GSM TS 
08.58, 8.4.19] sent from the TRX to the BSC. The common 
information element sought within these two messages is the 
same as that for the channel activation procedure described 
above i.e. the channel number. 10 milliseconds has been 
found to be a suitable time window for this message pair. 
Use of the channel release procedure has the same advan- 
tages and disadvantages as use of the channel activation 
procedure. 

The messages utilised in process 1, TRX discovery pro- 
cedures are shown in FIG. 7. 
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Process 2 — Aggregation of TRXs belonging to the same cell 
This process is often required because for many GSM- 

type networks it is not possible to successfully carry out 

processes 3 and 4, the determination of respectively the Cell 
5 Identifier (CI) and Location Area Identifier (LAI), for all 

TRXs within one cell. 
However, if TRXs belonging to the same cell have been 

aggregated (either before or after determination of CI and 

LAI) then the CI or LAI determined for any TRX within that 
10 cell can be assigned to the other TRXs known to belong to 

the same cell. 

Whether or not process 2 is required in the discovery 
procedure is dependent on the choice of channel allocation 
strategy that has been made by the network operator. The 

15 network operator may choose to use the same channel 
allocation strategy throughout his network, or may choose to 
use different channel allocation strategies in different parts 
of the network. At any given moment the available Traffic 
Channels (TCHs) within a BSC are either allocated to the 

20 exclusive use of an MS, or form part of a pool of idle 
channels from which a channel is drawn when required. 
There are a number of different circumstances in which a 
channel needs to be allocated, for example call set up, 
location updating, handover, and these different situations 

25 require different radio channel resources. However, the MS 
initially gives only a rough description of its requirements 
for a traffic channel, thus a strategy for channel allocation is 
required. GSM network operators have a choice of three 
channel allocation strategies. 

30 These strategies are described with reference to FIG. 8. 
Very Early Assignment (VEA) consists in allocating a traffic 
channel at the initial assignment. This strategy can be very 
inefficient in its use of radio resources since a full traffic 
channel may be allocated when not required. Early Assign- 

35 ment (EA) comprises allocating a Standalone Dedicated 
Control Channel (SDCCH) and then subsequently allocating 
a TCH as soon as it is known for sure that this type of 
channel will be required. Off Air Call Set Up (OACSU) 
comprises allocating an SDCCH initially, then waiting until 

40 the called party has answered before attempting the subse- 
quent assignment of a TCH. This strategy may result in a 
significant delay in connecting the parties, once the called 
party has answered, dependent on the availability of TCHs 
at this instant. 

45 If VEA is employed in the part of the network being 
monitored, then process 2 of the discovery method is not 
necessary since sufficient signalling messages will be passed 
to and from each TRX for processes 3 and 4 to determine the 
CI and LAI for each TRX. However, even where VEA is 

50 employed process 2 may still be utilised in the discovery 
method, although not absolutely necessary, in order to speed 
up the discovery method. 

If EA or OACSU are utilised it is common practice 
amongst network operators to configure TRXs within a cell 

55 so that SDCCHs are very often (or indeed always) assigned 
to the same, single TRX within a cell. Furthermore, in 
general this same TRX is chosen as the TRX to carry the 
CCCH for the cell. In this case processes 3 and 4 can 
determine the CI and LAI only for this one TRX within the 

60 cell, and process 2 is required to allow the CI and LAI to be 
assigned to the other TRXs within the same cell. 

When a BSC allocates a new TCH, it will communicate 
with a first TRX handling SDCCH and then it will commu- 
nicate with a second TRX on which the new TCH is to be 

65 established. In some circumstances these two TRXs may be 
the same. Some of the messages sent to the two TRXs by the 
BSC during the setting up of the new TCH contain common 
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information elements and, if these can be identified, the two 
TRXs can be determined to be within the same cell. Two sets 
of messages have been identified which can be used to 
aggregate TRXs belonging to the same cell. One set can be 
utilised only when ciphering has been implemented by the 
network operator, and the other set can be utilised whether 
or not ciphering has been implemented. 
Procedure requiring ciphering to be implemented 

When ciphering is implemented, a ll data sent over the 
radi o patrTis encrypted by an algorithm termed A5 [GSM 
TS03720] which utilises a key termed Kc. This key is 64 bits 
long and is calculated independently by both the MS and the 
network each time a radio connection is set up. The key Kc 
is never transmitted over the radio path but is calculated at 
the MS, and within the network using a further algorithm 
termed A8 [GSM TS03.20]. 

Two inputs are required by the algorithm A8 in order to 
generate the key Kc. The first, a further key termed Ki is 
stored by both the SIM, within the MS, and by the Authen- 
tication Centre (AuC) within the network. The second input 
required by A8 is a random number RAND created ran- 
domly by the network and sent to the MS each time a radio 
connection is set up. Once the key Kc has been calculated, 
this is sent to the TRX so that it can decipher coded radio 
messages received from the MS. In order to identify, and to 
aggregate, the SDCCH TRX and the TRX on which the new 
TCH is to be allocated, the ENCRyption CoMmanD [GSM 
TS 08.58 8.4.6] and CHANnel ACTIVation [GSM TS 08.58 
8.4.1] messages are monitored. 

Both messages belong to the RSM protocol and they are 
sent from the BSC to a TRX (see FIG. 9), The ENCR CMD 
message is sent, on the Abis interface, to the TRX handling 
the SDCCH after the access request and before the full call 
information and carries the ciphering key Kc calculated by 
the network. The same key is carried by the CHAN ACTIV 
message that is sent to the TRX which is assigned the 
required TCH once the BSC knows which type of call is 
required by the MS. The common element sought in these 
two messages is the ciphering key Kc, which is carried 
within the Encryption Information [GSM TS 08.58, 93.7] 
element of the messages. Because this ciphering key is 
several octets long, it is very unlikely that the same key will 
be used by more than one radio connection during the same 
time window. Hence, once a pair of ENCR CMD and CHAN 
ACTIV messages have been monitored which contain the 
same ciphering key Kc, and which have been sent to two 
different TRXs, these two TRXs are recorded by the analyser 
as belonging to the same cell. 

The time window utilised for the matching of these 
messages needs to be relatively long since a number of 
procedures are carried out in the time between these two 
messages ( eg call set up) so that the typical interval between 
them is long. Two seconds has been found to an effective 
time window. 

Procedure not requiring ciphering to be implemented 

The following technique can be utilised to aggregate 
TRXs regardless of whether ciphering has been imple- 
mented by the network operator. The pair of messages 
employed are the CHAN ACTIV [GSM 08.58, 8.4.1] mes- 
sage and the ASSIGNMENT COMMAND [GSM 04.08, 
9.1.2] message. These messages are sent from the BSC to a 
TRX on the Abis interface. The assignment command mes- 
sage is part of the RR protocol and is carried within a DATA 
REQuest message [GSM 08.58, 8.3.1] which itself is part of 
the RSM protocol. The assignment command message is 
transparent to the receiving TRX, which simply forwards it 
on to the relevant MS. 
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The CHAN ACTIV message, as discussed above, is sent 
to the new TRX on which the new TCH is to be allocated. 
Once the new TCH has been allocated, the BSC sends a 
DATA REQ message, containing an assignment command, 

5 on the Abis interface to the old TRX (the one handling the 
SDCCH), in order to give the MS sufficient information to 
switch to the new TCH, this is shown schematically in FIG. 
10. The CHAN ACTWV message and the assignment com- 
mand message both contain the channel number [GSM TS 

10 08.58, 9.3.1]. This is the same common information element 
as utilised in two of the process 1 procedures for discovering 
TRXs described above. The matching of this information 
element between these messages occurs in accordance with 
the message matching technique described above, with 

15 reference to FIG. 5. Once the same channel number element 
has been identified within two of these messages, within the 
requisite time window, the two TRXs are recorded by the 
analyser 15 as belonging to the same cell. Since, as stated 
above, the channel number element can assume only 120 

20 different values, the time window value for this matching 
procedure must be carefully chosen. 30 milliseconds has 
been found to be a suitable time window for this message 
pair. 

In order to improve the accuracy of TRX aggregation, a 

25 further common information element which may be present 
in these messages, can be utilised. If the network operator 
requires compatibility with GSM phase 1 equipment, a 
channel identification element [GSM TS 08.58, 9.3.5] will 
be present not only in the ASSIGNMENT COMMAND 

30 message but also in the CHAN ACTIV message and thus 
may used for matching purposes. The channel identification 
element provides the MS with information regarding the 
absolute frequency or frequency hopping parameters 
required for the TCH which the MS will switch to. The 

35 channel identification element has two parts, the channel 
description [GSM TS 04.08, 10.5.2.5] and the mobile allo- 
cation part [GSM TS 04.08, 10.5.2.21]. The channel descrip- 
tion part and mobile allocation part of the channel identifi- 
cation element in CHAN ACTIV messages are always 

40 together, however these two parts are in separate sections of 
ASSIGNMENT COMMAND messages. Thus when match- 
ing channel identification elements each part of the element 
must be matched separately. When the channel identification 
element is utilised for matching messages, a match is not 

45 deemed to be successful unless both parts of the channel 
identification element match. When employing both the 
channel identification element and the channel number ele- 
ment to aggregate TRX s, aggregation is only carried out 
when both elements are successfully matched within their 

50 respective messages. 
Directed Retry 

Both of the procedures described above for carrying out 
process 2 to aggregate TRXs assume that the TRX on which 
the new TCH is assigned is within the same cell as the 

55 SDCCH TRX. This is not always the case. Phase 2 of the 
GSM standard provides for the assignment of a TCH to an 
MS from a TRX in a cell other than the current cell of the 
MS. This feature is termed Directed Retry [GSM TS 03.09, 
11]. The result of such a directed retry is shown schemati- 

60 cally in FIG. 11. Clearly, if the new TCH for the mobile is 
assigned to a TRX in a different cell, it would be incorrect 
to aggregate the SDCCH TRX and the new TRX as belong- 
ing to the same cell. This problem can be avoided by the 
network discovery method by monitoring a further informa- 

65 tion element, the activation type [GSM TS 08.58, 9.3.3] 
within the CHAN ACTIV message which indicates when a 
directed retry is occurring. 
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A directed retry is initiated when the serving cell chosen the Abis interface. This EST IND message is the first 

by the MS in idle mode is different from the serving cell monitored message looked for by the present procedure, 

chosen by the network. In this case, in phase 2 implemen- Receipt of the EST IND message at the BSC causes the BSC 

tations of GSM, rather than performing an assignment to the to compile a COMPLETE LAYER 3 INFORMATION mes- 

MS chosen cell and then a subsequent handover to the 5 sage [GSM TS 08.08, 3.2.1.32] which incorporates the 

network chosen cell, a handover is performed immediately, initial message and further information including the CI or 

prior to assignment. In this case, the activation type element in some cases the GCI for the cell served by the TRX which 

of the CHAN ACTIV message will indicate that activation generated the EST IND message. This COMPLETE LAYER 

is related to inter-cell channel change. Thus both procedures 3 INFORMATION message is passed from the BSC to the 

for carrying out process 2 TRX aggregation monitor for this 10 MSC, and is the second monitored message. By monitoring 

indication within the activation type element, and if found these two messages, and matching the initial message ele- 

discard the related messages as belonging to a directed retry. ments found within each, within a time window as described 

Although such messages cannot be used to determine that above, the CI for a particular TRX on a particular channel 

the two TRX s involved belong to the same cell, they do (labelled by the physical identifier given by the monitoring 

indicate that the two TRXs definitely do not belong to the 15 system) can be identified. 30 milliseconds has been found to 

same cell. This information may be usefully employed by be a suitable time window for this message pair. Depending 

the analyser 15 in confirming the correct aggregation of on the number of other steps within the network discovery 

TRXs. method that have been successfully carried out, the CI can 

FIG. 12 is a flowchart which schematically shows the be allocated to a TRX identified by its TEI (Process 1), and 

procedure carried out by the monitoring equipment during 20 can also be allocated to other TRXs aggregated as belonging 

Process 2, aggregation of TRXs. to the same cell (Process 2). 

Process 3 — Determination of Cell Identity Preferably, the whole of the initial message is utilised as 

The Cell Identity (CI) is a value of fixed length with two the common information element looked for when matching 

octets, which identifies the cell within its location area messages according to this procedure. However, all five of 

[GSM TS 08.08, 3.2.2.27]. The CI does not uniquely iden- 25 the initial messages types contain a mobile identity element 

tify the cell within the network, unless it is concatenated [GSM TS 04.08, 10.5.1.4] (eg. IMSI or TMSI) and this 

with the LAI to form the CGI (Cell Global Identification). In mobile identity element alone can form the common infor- 

some cases the GCI can be determined at the same time as mation element, 

the CI, so that process 4 (Determination of Location Area Handover Procedure 

Identifier) is not required. 30 This procedure identifies CIs and allocates them to par- 
Two procedures can be used to correlate CIs with TRXs, ticular TRXs by monitoring messages which are generated 
one based on monitoring messages containing "initial mes- during inter BSC handovers, i.e. handovers of the MS 
sages" sent by an MS during the channel assignment between different BSCs via an MSC. With reference to FIG. 
process, and the other based on monitoring handover 14 when an inter BSC handover is initiated the MSC 21 
requests. Both these procedures require messages on the A 35 serving the two BSCs 17 and 19 sends a HANDOVER 
interface to be monitored in addition to messages on the Abis REQUEST message [GSM TS 08.08, 3.2.1.8] to the BSC 17 
interface since the CI does not appear in signalling messages serving the BTS 18 in which the target cell for the handover 
on the Abis interface. is located. This HANDOVER REQUEST message is sent 
' 'Initial Message" Procedure within the BSSMAP protocol on the A interface, and con- 
When a request from an MS for a channel assignment has 40 tains the CI for the cell presently serving the MS, and the CI 
?een accepted by a BI S, the ±3 I S sends the MS information for the target cell to which the MS is to be handed over. By 
regarding the allocated channel on the downlink CCCH. monitoring two different messages (one for the serving cell 
When the MS has received this information, the first action and one for the target cell, as described below) on the Abis 
it takes on the new channel is to establish a link layer interface, and matching each of these with the HANDOVER 
connection for signalling messages on the new channel. Thi s 45 REQUEST message on the A interface, both the serving cell 
is achieved by sending a SABM (Set Asynchronous Bal- CI and the target cell CI can be determined and allocated to 
a need Mode) frameJThe SABM frame itself carries a layer TRXs. 

ageTtermed the "initial message" [GSM TS Unfortunately, the HANDOVER REQUEST message 
04.08], which is "piggybacked" onto the SABM frame. does not contain a common information element that can be 
Five different initial messages are allowed by the GSM 50 matched with the relevant messages on the Abis interface, so 
specifications, which messages each carry data related to the a preliminary matching between the HANDOVER 
reason the initial access was triggered. The five possible REQUEST message and a further message on the A interface 
reasons for triggering an initial message are 1) a response to must be carried out. This message is the HANDOVER 
a paging request, 2) normal or periodical location updating REQUEST ACKnowledge message [GSM TS 08.08, 
or an IMSI attach, 3) an IMSI detach, 4) CM 55 3.2.1.10] which is sent from the BSC 17 to the MSC 21 
re-establishment request and 5) service request (e.g. call set within the BSSMAP protocol in response to the HAN- 
up, SMS, Supplementary Service Management). In each DOVER REQUEST message. Within the SCCP layer of a 
case the initial message sent by the MS is incorporated into message sent on the A interface there is an SCCP header 
two further messages, the first on the Abis interface and the which comprises routing information including source and 
second on the A interface. The present procedure utilises the 60 destination addresses in terms of point codes. In any par- 
initial message element within these messages as the com- ticular message between a BSC and MSC these point codes 
mon information element to achieve matching between the comprise source and destination local references dependent 
messages. In greater detail and with reference to FIG. 13, the on the direction in which the message has been sent. These 
SABM frame (with piggybacked initial message) sent by the local references remain the same for the duration of the 
MS to the TRX on the radio interface causes the BTS to send 65 SCCP connection and, since a HANDOVER REQUEST 
an RSM ESTablish INDication message [GSM TS 08.58, message and the corresponding HANDOVER REQUEST 
8.3.6] which incorporates the initial message to the BSC on ACKnowledge message are sent on the same SCCP 
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connection, can be used to match these messages. Thus the 
SCCP header information is monitored by probes 13 on the 
A interface and the analyser 15 is arranged to match HAN- 
DOVER REQUEST messages and HANDOVER 
REQUEST ACKnowledge messages having the same 
source and destination local references. Further details of the 
tracking of SS7 SCCP addressing information on the A 
interface can be found in co-pending U.S. patent application 
Ser. No. 08/851 041, which is incorporated herein by ref- 
erence. 

Although the HANDOVER REQUEST ACK message 
contains common information elements that can be matched 
with messages on the Abis interface as described below, it 
does not contain the CI for the serving or target cells. Thus 
once matching with Abis messages has been successfully 
performed, the CI's are acquired from the associated HAN- 
DOVER REQUEST message. 
Serving Cell CI 

The serving cell CI can be determined by matching 
common information elements between the HANDOVER 
REQUEST ACK message and an RR-HANDOVER CMD 
message sent from the serving BSC 19 to the serving BTS 
20. This HANDOVER COMMAND [GSM TS 04.08, 
9.1.15] is sent on the Abis interface within a DATA 
REQUEST message of the RSM protocol. The HAN- 
DOVER CMD is also contained within the HANDOVER 
REQUEST ACK, thus allowing matching between the 
DATA REQUEST message and the HANDOVER 
REQUEST ACK message. Since the whole of the HAN- 
DOVER COMMAND is included within both messages, 
this forms the common information element and matching is 
performed between all elements of the HANDOVER COM- 
MAND. If the HANDOVER COMMAND is correctly 
matched within a time window (2 seconds has been found to 
be effective) as described above, then the serving cell CI 
carried within the HANDOVER REQUEST message 
(matched to the HANDOVER REQUEST ACKnowledge 
message) can be allocated to the serving TRX within the 
BTS 20. 

Target Cell CI , 

When the MS is detected at the target BTS 18, a HAN- 
DOVER DETECTION [GSM TS 08.58 8.4.7] message is 
sent over the Abis interface on the RSM protocol from the 
target BTS 18 to the BSC 17. Both the HANDOVER 
DETECTION message and the HANDOVER REQUEST 
ACK message contain a channel number (giving the channel 
type and time slot allocated to the MS within the target cell), 
and this common information element is utilised to match 
these messages within a time window (3 seconds has been 
found to be effective). Matching of the messages allows the 
target cell CI (within the HANDOVER REQUEST message 
matched to the HANDOVER REQUEST ACK message) to 
be allocated to the serving TRX within the BTS 18. 

FIG. 15 is a flowchart which schematically shows the 
procedure carried out during Process 3, determination of CI. 

Again, the CIs for the target and serving cells can be 
allocated to other TRXs known to be within the same cell via 
a Process 2, TRX aggregation step. 
Process A — Determination of Location Area Identity 

As stated above during the description of Process 3 
(Determination of Cell Identity), the COMPLETE LAYER 
3 INFORMATION message may contain a GCI rather than 
simply a CI. If this is the case, the LAI may be determined 
from the GCI without any further information. Alternatively, 
if only the CI is found within the COMPLETE LAYER 3 
INFORMATION message, or if Process 3 has not yet been 
carried out, one of the following three procedures may be 



utilised to determine the LAI. The first procedure is based on 
monitoring paging messages, and requires matching of 
messages between the A and the Abis interfaces. The second 
and third procedures are both based on monitoring location 
5 updating messages, and do not require matching of infor- 
mation between messages, but simply the selection of the 
correct message, and the extraction of the LAI. 

Papyri fr procedure- 

The location area is a concept utilised by OSM type 
to networks which seeks to strike a balance between the 
number of cells which must be paged to locate a particular 
MS, and the amount of signalling traffic generated by MSs 
updating the fixed part of the network with their current 
location. The location area is a logical grouping of a plurality 
15 n f^cells having a common location area identification— An 
M S only initiates a location updating process when it 
determines that it has changed location areas, thus reducing 
the amount of location updating network traffic. When the 
network needs to route an incoming call to a particular MS 
20 it will only need to transmit a paging message to the cells 
within the relevant location area, rather than to all cells 
within the network. 

With referencet^FIPi Irf^when thejyd network neer]* 

to notify an MS~of an innnny ing; call, t he MSC 5 sends a 

25 PAGINCLnifissage [GSM TS 08.08, 3.2.1.19] witfugjhe 
B SSMAP protocol o n t he A inter fa ce to the BjSCsJLcoygring 
th e loca tion area in which the"MS i s known to be. The 
paging messageTs specific to one anH majpins infor- 
ma tion regard ingThe cells in which the PAGING message 

30 must_be broadcast, ancTmay contain th e LA L Thence Us 
wit hin a locationarea are gerierallyserve^bv oj e-BSC 8 but 
in sogie cases may be seryepVby rrjore_than one BS C^as 
shown in FIG! 16. ThTonly restriction imposed by the GSM 
specifications re garding which cells belonging to a location 

35 area7"Ls"that alf cells must be under the control of a single 
MSC 5. Each BSC 8 receiving the PAGING message then 
se nds a j AQing-CeMflaanD message [GSM TS 08.58, 8.5.5] 
wi thin theRS M pr^^l on the Abis interface to each TRX 
havi ng a PCH (Paging ChanneD within the relevant location 

40 area. Only one TRX within a cell will be utilised to broad- 
cast the PCH. 

The PAGING message and the PAGing CoMmanD mes- 
sage both contain a common information element, namely 
the mobile identity element of the MS being paged. This 

45 mobile identity element will be the IMSI, or if a TMSI has 
been established between the MS and the network, the TMSI 
is utilised for security reasons. Thus the monitoring system 
14 monitors for PAGING messa pe ^ on the A int erface, and 
PAGing Cojm ManD messages on the Abis interface, an d (if 

50 the PAGING message containsj m_LAI) atte mpts to m atch 
the m cjrfle~~iaenuty elements Jotmd-jyJthin these messages 
witrnlfa time window as described above. The time window 

used within this paging procedure may safely be very long 

because an IMSI is unique globall y and a TM SI is unique 

55 within a particular locatiorTarea. Thus it is unlikely, if two 
identical TMSFS are found, that they will relate to different 
MSs. Furthermore, because paging messages are often 
repeated if there is no response from the MS it is advanta- 
geous to utilise a long time window. It has been found that 

60 time windows of up to one minute are effective. 

When a matcfr has been found the an alyser I fi is ahle to 
correlate the LAI found within the PAGING message with 
the TRX to which the matching PAGing ComManD mes- 
sage has been sent. As stated above, PAGing ComManD 

65 messages will only be sent to TRXs which broadcast PCHs. 
However, once Process 2 (Aggregation of TRXs belonging 
to the same cell) has been carried out the LAI allocated 1 
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a TRX-transmitiin g a PC" can be allocated to all other TRXs 
_wjttunJhe same cell. Furthermore, by matching the PAGING 
message on the A inte rface with each of the PAGing Com- 
M anD messa ges on the Abis interface the LAI for all cells 
within the locat ion area may be determined. 
Location Updating Procedures 

A number of messages sent during location updating can 
be utilised to determine the LAI for a TRX without the need 
to perform message matching. Two of these mess ages are of 
the "initial message" type sent from the MS to the fixed 
network, and the third one is a message sent from the fixed 
network to the MS in response to a location updating 
request. 

The IMSI attach [GSM TS 04.08, 4.4.3] is a specific type 



10 



method. However, the following three messages could pos- 
sibly be sent on the Abis interface 1) SACCH INFO 
MODIFY [GSM TS 08.58, 8.4.20] 2) BCCH INFOrmation 
[GSM TS 08.58, 8.5.1] and 3) SACCH FILLING [GSM TS 
08.58, 8.6.2]. Monitoring of any of these three messages will 
enable the CI and LAI for a particular TRX to be determined 
from the message content without requiring matching to any 
other messages. 
What is claimed is: 

1. A network discovery method for determining informa- 
tion about a cellular mobile radio network comprising a 
fixed part having switching elements and radio elements 
providing radio coverage in a plurality of cells, each cell 
having at least one said radio element, and mobile stations 



of initial message which is sent when an MS re-registers 15 for communicating with said fixed part via the radio 



within a location area in which it had previously been 
registered. This IMSI attach message is incorporated within 
an RSM establish indication message and is sent by the 
serving TRX over the Abis interface to the serving BSC. For 
the present purposes the important aspect of the IMSI attach 20 
message is that it contains the LAI in which the MS is 
located. Thus the LAI can be correlated with the TRX that 
sent the establish indication message without needing to 
perform any message matching. Unfortunately for the 
present purposes, the IMSI attach, and its corresponding 25 
detach procedure is not mandatory within GSM type 
networks, thus the network operator may choose not to 
implement this procedure. 

Asecond form of initial message which may be monitored 
to determine LAI without message matching is that of call 30 
re-establishment. The call re-establishment procedure [GSM 
TS 04.08, 4.5.1.6] can be considered as an emergency, MS 
triggered, handover procedure which is implemented when 
a call connection is suddenly lost. In these circumstances the 
MS sends a RE-ESTABLISHMENT REQUEST which is 35 
incorporated by the TRX into an RSM establish indication 
message, and passed to the BSC on the Abis interface. In 
cases where the TMSI is used as the mobile identity, the LAI 
is also incorporated into this message in order to unambigu 



elements, the method comprising: 

monitoring signalling messages passed between the radio 

elements and the switching elements, 
selecting at least one signalling message in accordance 
with occurrence of the signalling message within a 
predetermined time window and in accordance with a 
predetermined selection criteria, 
extracting data from said at least one signalling message, 
correlating said extracted data with previously extracted 
data and, 

repeating said selecting, extracting and correlating steps 
until each monitored radio element is identified with 
respect to other network entities. 

2. A network discovery method as claimed in claim 1, 
wherein said selecting step comprises selecting a pair of 
related messages. 

3. A network discovery method as claimed in claim 2, 
wherein the predetermined selection criteria for selecting a 
pair of messages are: 

i) each message is of a different message type, and 

ii) the messages contain at least one information element 
in common. 

4. A network discovery method as claimed in claim 3, 



ously identify the MS. This call re-establishment facility is 40 comprising a further matching step in which the common 



also not mandatory so network operators may choose not to 
implement it. 

A third location updating message that can be monitored 
to determine an LAI without message matching is the 
LOCATION UPDATING ACCEPT message [GSM TS 45 
04.08, 9.2.13]. The LOCATING UPDATING ACCEPT 
message is sent by the serving MSC in response to a 
LOCATION UPDATING REQUEST message [GSM TS 
04.08, 9.2.15] sent by the MS. The LOCATION UPDATING 



information element in each of the messages is compared 
and data from the pair of messages is only utilised in said 
correlating step if the common information element in each 
message is identical. 

5. A network discovery method as claimed in claim 4, 
wherein at least three messages are selected and wherein one 
message is matched to a plurality of messages of the same 
message type. 

6. A network discovery method as claimed in claim 2, 



ACCEPT message is transparent to the BTS which simply 50 wherein data from a pair of messages is only utilised in said 



passes it on to the relevant TRX within a DATA REQUEST 
message. By monitoring for this message on the Abis 
interface, which contains the LAI of the MS's current 
location, this LAI can be allocated to the TRX to which the 
message has been sent. 

FIG. 17 is a flowchart which schematically shows the 
procedure carried out during Process 4, determination of 
location area identifier. 
System Information Messages 



correlating step if the messages are monitored within a 
predetermined time period of each other. 

7. A network discovery method as claimed in claim 1, 
wherein the cells are logically grouped into location areas 

55 and each radio element is uniquely identified by the cell 
within which it resides, and the location area within which 
the cell resides. 

8. A network discovery method as claimed in claim 1, 
wherein signalling messages passed between two switching 



Occasionally a configuration parameter, for example the 60 elements are also monitored. 



LAI of a cell, may be changed by the network operator, and 
a system information message will be sent out giving details 
of such a change. The frequency of these messages will 
depend on the maturity of the operator's network, but 
typically configuration parameters are likely to be changed 
only over long time scales such as a week or a month and are 
thus not particularly useful for the present discovery 



65 



9. A network discovery method as claimed in claim 1, 
wherein the cellular mobile radio network is of the GSM 
type and messages are monitored across the Abis interface 
between radio elements and switching elements. 

10. Apparatus for identifying the relationship between 
radio elements and other network entities within a cellular 
mobile radio network, the network comprising a fixed part 
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having switching elements and radio elements providing 
radio coverage in a plurality of cells, each cell having at least 
one said radio element, and mobile stations for communi- 
cating with said fixed part via the radio elements, the 
apparatus comprising: 5 
probe means for monitoring signalling messages passed 

between an identified one of the radio elements and the 

switching elements, 
extracting means for extracting data from at least one 

predetermined signalling message selected in accor- 10 

dance with occurrence of the signalling message within 

a predetermined time window, and 
analysis means for determining from extracted data a rela- 
tionship between the monitored radio element and other 
network entities. 15 

11. Apparatus as claimed in claim 10, wherein the extract- 
ing means extracts data from related pairs of signalling 
messages, and the analysis means compares at least a part of 
the extracted data and, if a match is found between such 

ID 

compared data, records a relationship between the moni- 
tored radio element and another network entity. 

12. Apparatus as claimed in claim 11, wherein the probe 
means attaches to each monitored message an indication of 
the time at which the message was monitored and the 
analysis means only utilise data from pairs of messages 25 
which are monitored within a predetermined time period of 
each other. 
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13. Apparatus as claimed in claim 12, wherein the pre- 
determined time period is substantially equal to the expected 
interval between the particular pair of messages monitored. 

14. Apparatus as claimed in claim 10, wherein the probe 
means attaches to each monitored message a physical iden- 
tifier which identifies the physical channel on which the 
message has been monitored. 

15. Apparatus as claimed in claim 14, wherein the analy- 
sis means builds a logical identifier, identifying a particular 
radio element, from data from monitored messages and 
relates this logical identifier to the physical identifier pro- 
vided by the probe means. 

16. Apparatus as claimed in claim 10, wherein the rela- 
tionship between monitored radio elements, cells and loca- 
tion areas comprising logically grouped cells, is determined. 

17. Apparatus as claimed in claim 10, wherein the analy- 
sis means determines for each monitored radio element the 
two physical channels on which messages are passed to and 
from the radio element. 

18. Apparatus as claimed in claim 10, wherein the analy- 
sis means determines which radio elements are within the 
same cell and allocates cell related information determined 
for any one radio element within the cell to the other radio 
elements within the same cell. 

***** 
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